CISA added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 28, based on evidence of active exploitation: CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, and CVE-2026-46300, a Linux kernel missing initialisation of a variable vulnerability.
The catalog operates under Binding Operational Directive 26-04, which requires federal civilian agencies to prioritise rapid remediation of high risk vulnerabilities on publicly exposed assets that grant total control after exploitation, and to check whether threat actors compromised a system before a patch was applied. CISA encourages all organisations to adopt the same risk based approach.
The additions continue a dense week for the catalog. Yesterday’s edition covered the October 27 additions, an Adobe Commerce and Magento file upload flaw and the Google Brotli flaw. The October 28 pair sits lower in the stack, in the hypervisor that hosts virtual machines and in the Linux kernel beneath them, which widens the set of systems operators need to check even though neither entry is an application flaw of the kind that dominated earlier in the week.